Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

From what I understand Key Escrow is where a copy of they key is stored in a safe place so they can be recovered later.

But in the context of PKI, a Recovery Agent can also recover private keys.

How are they different? Does a Recovery Agent use a Key Escrow?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

A "Key Escrow" is used in cases where a third-party needs access to encrypted data, as defined by law (so if you get a court order to decrypt data), while a "Recovery Agent" is someone who is permitted to decrypt another user's data in case of emergency and has a key that can accomplish the decryption.

So in effect, the key escrow is someone who holds the keys for each user, while a recovery agent has a master key.

Edit: "Recovery Agent" is actually defined by Windows too, so you can access EFS-protected files of other users. See: http://searchitchannel.techtarget.com/definition/data-recovery-agent-DRA for details.

share|improve this answer
    
Strictly speaking, the "Key Escrow" isn't just something that's implemented for legal reasons. It could just be the way the company chose to implement their recovery process. Other than that, the distinction between Escrow vs. Agent is pretty accurate here. –  Iszi May 17 '13 at 14:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.